GitHub malicious-dependency incident touching protocol deps

Evidence summary #

GitHub-flagged malicious-dependency incident. Applicable: openeden.vault.audit uses OZ 4.9.0 (npm/Hardhat). No GitHub advisory for OZ 4.9.0 found as of 2026-05-16. No malicious dependency release in last 90 days found through GitHub advisories or web search. OZ 4.9.0 is widely deployed; any advisory would be widely reported. Code-security analyst responsible for full OZ version CVE check (RD-F-135 scope).

Sources #

Methodology #

Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.

See the full factor methodology and distribution across all protocols →